This vulnerability (CVE-2026-28146) is classified as CWE-22, an improper limitation of a pathname to a restricted directory, commonly known as path traversal. It affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to and including 2.0.14. The flaw allows a contributor-level user to download arbitrary files from the system by bypassing directory restrictions. The CVSS v3.1 base score is 6.5, with an attack vector of network, low attack complexity, requiring low privileges (contributor), no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No vendor patch or official fix has been documented in the provided data.

An attacker with contributor-level privileges can exploit this vulnerability to download arbitrary files from the server, potentially exposing sensitive information. The confidentiality impact is high, but integrity and availability are not affected. This could lead to information disclosure but does not directly allow code execution or system disruption based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor vendor communications for updates. Until a fix is available, restricting contributor privileges or limiting file access permissions may reduce risk but are not guaranteed mitigations.